You can link authentication providers to your platform to allow your users to log in using their company credentials. You can integrate any identity provider that is compatible with SAML 2.0 and OpenID protocols. If you use SAML just-in-time, users will be imported during their initial login if they don't already exist on your platform. 

This article outlines the steps for setting up a SAML authentication provider in Haiilo. Below, you can view a video tutorial for setting up SAML for AD FS.

You will also need to complete certain steps in your identity provider to finalize the connection. To configure SAML in your identity provider, we recommend referring to the guidelines for your specific identity provider.

While Haiilo itself doesn't offer two-factor authentication, you can use a SAML service to do so. You need to ensure that the service uses a certificate from a trustworthy certification body and TLS 1.2.

Set up a SAML authentication provider

When setting up a SAML authentication provider, it can only apply to one user directory and that directory's users. You need "Manage authentication providers" permission to set up an authentication provider in Haiilo.

1. Go to Administration > Authentication
2. Select Create authentication provider
3. Enter a name. The name is displayed to users on the login screen after "Authenticate with"
4. Choose a type: SAML or SAML just-in-time
5. Check Active
6. Decide if you want to use Automatic login. This automatically redirects the user from the login screen to the identity provider after a few seconds. If users don't want to be redirected, they can select Sign in as a local user before the redirect.
7. Decide whether this authentication provider sends session emails for new logins.
8. Fill out the fields on each tab as detailed below.

General

1. Only check AD FS if your Microsoft Active Directory uses Federation Services.
2. Enter the Entity ID, Authentication endpoint, and Logout endpoint from your identity provider's metadata.xml.
3. Choose the Logout method. This defines whether the user is logged out locally (only Haiilo) or globally (SAML logout) when they log out of Haiilo.
4. Enter an Answer validity, i.e., the timeframe for queries. We recommend the standard 300 seconds.
5. Choose the User directory that can use this authentication provider. The options depend on your user directory settings.

Request signing

1. Check Sign requests if you want to sign the SAML request with a certificate and a private key. Otherwise, skip this tab.
2. Enter a certificate and a private key in the PEM format. You can use a self-signed certificate. The certificate must be added to the ADFS server in the trust relationship settings under "Signing".
3. If the private key is password protected, enter the password

Response validation

1. In addition to signing requests, you can check the SAML server's response. To do this, add the IdP server's token-signing certificate in the PEM format.
2. If you don't want to use this function, check Disable certificate trust check

Just-in-time provisioning

This tab is only available if you select the type SAML just in time.

1. Define the attributes that are imported for the users. You can find the necessary values in your metadata.xml.
2. You can also synchronize profile fields. Choose the profile fields on Haiilo and assign them according to the values in your metadata.xml.

Finalize

1. Select Save to generate the Haiilo endpoints and metadata XML. After saving, these will appear on the General tab.
2. Add Haiilo's information to your IdP. Haiilo only establishes a redirect to the IdP and then expects a SAML assertion, in which the login name (e.g., the email address) is passed as NameID.
   • For SAML just-in-time, the attributes that are provisioned must also be configured in the SAML assertion.